coollabsio
- Total products in the ecosystem
- 1
- Total vulnerabilities (90 days)
- 5
en
A short verification protects source data and prevents automated AI requests.
Verifying...
As of 11/08/2026, coollabsio recorded 5 security vulnerabilities in the last 90 days across 1 products, including 2 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, coolify had the most security vulnerabilities in the coollabsio ecosystem, with 5 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook EndpointsCVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authenticationCVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorizationCVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email MatchingCVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-121587Coolify before 4.1.1 Application Name Enumeration via Manual Webhook Endpoints | Exploitation statusNot confirmed | FixYes |
| Published11/03/2026 |
| SeverityMedium |
CVE-2026-100746coollabsio Coolify GitHub App Setup redirect missing authentication | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-100744coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published09/27/2026 | SeverityMedium |
|---|
CVE-2026-86117Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published09/05/2026 | SeverityCritical |
|---|
CVE-2026-84694Coolify before 4.2.0 Remote Code Execution via Environment Variable Key | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published09/02/2026 | SeverityHigh |
|---|
CVE-2026-15507coollabsio Coolify Policy Policies authorization | Exploitation statusActively exploited | FixNo | Affected productcoolify | Published07/12/2026 | SeverityMedium |
|---|
CVE-2026-59734Coolify: OS Command Injection in Health Check Configuration Allows Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/09/2026 | SeverityHigh |
|---|
CVE-2026-42201Coolify: OS Command Injection via Database Credential Fields in Docker Compose Service Commands | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42200Coolify: PostgreSQL Init Script Path Traversal Leads to Arbitrary File Write and Root RCE | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-42172Coolify: Sanctum API Tokens Have No Expiration — Leaked Tokens Grant Permanent Access | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42147Coolify: SSRF via S3 Storage Endpoint in testConnection() | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-42145Coolify: File Upload Without Type or Size Validation in Database Backup Restore | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-42143Coolify: OS Command Injection via Persistent Volume Names - Root RCE on Managed Servers | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34198Coolify: Password reset link poisoning via X-Forwarded-Host header spoofing | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-34171Coolify: Account takeover via CSRF-able GET endpoint that resets password to attacker-known value | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34170Coolify: Server-Side Request Forgery via attacker-controlled GitHub App API URL | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityMedium |
|---|
CVE-2026-34168Coolify: Command injection via unsanitized persistent storage name in docker volume commands | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34158Coolify: Command injection via single-quote breakout in Docker Compose custom commands | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34152Coolify: Command Injection via Newline in Pre/Post Deployment Commands (Heredoc Transport) | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34149Coolify: Authenticated Host-Level RCE via Unescaped Database Credentials in Backup Jobs | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityLow |
|---|
CVE-2026-34058Coolify: OS Command Injection via Unmanaged Container Operations - Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34057Coolify: Authenticated Remote Code Execution via Command Injection in Database Import Container Name | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34048Coolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34047Coolify: WebSocket Endpoint Access Control Flaw Leading to Remote Code Execution | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34044Coolify: Cross-team IDOR in logs component (resource lookup not team-scoped) | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34037Cross-Tenant Resource Cloning via Broken Object-Level Authorization in cloneTo() | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityCritical |
|---|
CVE-2026-34035Coolify: Host RCE via Log Drain secret/env command injection | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-34034Coolify: Host RCE via Sentinel token injection | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/07/2026 | SeverityHigh |
|---|
CVE-2026-42204Coolify: Authenticated RCE via SHELL_SAFE_COMMAND_PATTERN regression → host root | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-42153Coolify: PostgreSQL Healthcheck Command Injection Allows Root Code Execution in Container | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-42148Coolify: Command Injection via Unescaped Version String in Docker Build | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityLow |
|---|
CVE-2026-41899Coolify unauthenticated feedback endpoint allows Discord webhook abuse | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34599Coolify: Authenticated Remote Code Execution in GetLogs Livewire Component | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-34167Coolify: Cross-tenant activity log disclosure via unlocked Livewire property in ActivityMonitor | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34153Coolify LocalFileVolume fs_path command injection enables RCE | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityHigh |
|---|
CVE-2026-34050Coolify Settings/Updates Livewire component missing instance administrator authorization | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-34049Coolify: Command Injection via unsanitized MongoDB collection names in database backup | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityLow |
|---|
CVE-2026-34038Coolify authenticated remote command injection leading to RCE and secret exfiltration | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityCritical |
|---|
CVE-2026-32718Coolify read-scoped API tokens can perform state-changing validation operations | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published07/06/2026 | SeverityMedium |
|---|
CVE-2026-27957Coolify: Authenticated RCE via command injection in CA certificate management feature | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityHigh |
|---|
CVE-2026-27956Coolify: Cross-team application domain enumeration via domains_by_server endpoint | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27955Coolify: Command Injection via Single-Quote Breakout in `executeInDocker()` | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27883Coolify: IDOR in Deployment API - Cross-Team Deployment Information Disclosure | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27882Coolify: Timing Attack in GitLab Webhook Token Validation | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-27881Coolify: Cross-team deployment information disclosure via GET /api/v1/deployments/{uuid} (IDOR) | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/30/2026 | SeverityMedium |
|---|
CVE-2026-57498Coolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/29/2026 | SeverityCritical |
|---|
CVE-2026-41896Coolify: Unauthenticated Deployment Trigger via Webhook HMAC Bypass with Null Secret | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34597Coolify: Authenticated Host RCE | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34594Coolify: Authenticated Remote Code Execution via Command Injection in Destination Network Management | Exploitation statusActively exploited | FixYes | Affected productcoolify | Published06/29/2026 | SeverityHigh |
|---|
CVE-2026-34592Coolify: Cross-Team IDOR via Unscoped Server and Project Lookups Exposes SSH Keys and Infrastructure | Exploitation statusNot exploited | FixYes | Affected productcoolify | Published06/29/2026 | SeverityHigh |
|---|
76 Results | Page 1 of 2